---
title: Provision resources and write output data
hide_title: true
---

# Output Data

Output data is data produced by Terraform as a result of running a configuration.
Output data can include values such as resource IDs, IP addresses, and other information about the resources that have been created.

With TF-controller, you can use the `.spec.writeOutputsToSecret` field to write the outputs created by Terraform to a secret.
A secret is a Kubernetes resource that stores sensitive data, such as passwords, API keys, and other confidential information.

## Write all outputs

To write all outputs created by Terraform to a secret using TF-controller, you will need to create a Terraform object and specify the .spec.writeOutputsToSecret.name field.

Here is an example of a Terraform object that writes all outputs to a secret named "helloworld-output":

```yaml {14-15}
apiVersion: infra.contrib.fluxcd.io/v1alpha1
kind: Terraform
metadata:
  name: helloworld
  namespace: flux-system
spec:
  approvePlan: auto
  interval: 1m
  path: ./
  sourceRef:
    kind: GitRepository
    name: helloworld
    namespace: flux-system
  writeOutputsToSecret:
    name: helloworld-output
```

In this example, the `.spec.writeOutputsToSecret.name` field is set to "helloworld-output",
which specifies the name of the secret that the outputs will be written to.
By default, the controller will write all outputs to the secret.

To use this `Terraform` object, you will also need to create a `GitRepository` object to specify
the location of the Terraform configuration files. In this example, the `GitRepository` object has the name "helloworld"
and is located in the "flux-system" namespace.

Once the `Terraform` and `GitRepository` objects are created, the controller will automatically write all outputs
created by Terraform to the specified secret. This can be useful in situations where you want to store the outputs
in a secure location or use them in other parts of your infrastructure.

## Selectively Writing Outputs

In addition to writing all outputs created by Terraform to a secret,
you can also choose to write only a subset of outputs by specifying the output names you want to write in the `.spec.writeOutputsToSecret.outputs` array.

To do this, you will need to create a `Terraform` object and specify the `.spec.writeOutputsToSecret.name` and `.spec.writeOutputsToSecret.outputs` fields.

Here is an example of a `Terraform` object that writes only the outputs with the names "hello_world" and "my_sensitive_data" to a secret named "helloworld-output":

```yaml {16-18}
apiVersion: infra.contrib.fluxcd.io/v1alpha1
kind: Terraform
metadata:
  name: helloworld
  namespace: flux-system
spec:
  approvePlan: auto
  interval: 1m
  path: ./
  sourceRef:
    kind: GitRepository
    name: helloworld
    namespace: flux-system
  writeOutputsToSecret:
    name: helloworld-output
    outputs:
    - hello_world
    - my_sensitive_data
```

In this example, the `.spec.writeOutputsToSecret.name` field is set to "helloworld-output",
which specifies the name of the secret that the outputs will be written to.
The `.spec.writeOutputsToSecret.outputs` field is an array containing the names of the outputs to be written to the secret.

## Renaming outputs

Sometimes you may want to rename an output in order to use it with other components in your GitOps pipeline.
For example, you may have a key in a secret manager that must be named a certain way in order to be used by other controllers.

TF-controller provides support for renaming outputs by using the `old_name:new_name` format in the `.spec.writeOutputsToSecret.outputs` field.

To rename an output with TF-controller, you will need to create a Terraform object and specify
the `.spec.writeOutputsToSecret.name` and `.spec.writeOutputsToSecret.outputs` fields.

Here is an example of a Terraform object that renames the "age_key" output to "age.agekey" and writes it to a secret named "helloworld-output":

```yaml {16-17}
apiVersion: infra.contrib.fluxcd.io/v1alpha1
kind: Terraform
metadata:
  name: helloworld
  namespace: flux-system
spec:
  approvePlan: auto
  interval: 1m
  path: ./
  sourceRef:
    kind: GitRepository
    name: helloworld
    namespace: flux-system
  writeOutputsToSecret:
    name: helloworld-output
    outputs:
    - age_key:age.agekey
```

In this example, the name field is still set to "helloworld-output",
but the outputs field now contains the `old_name:new_name` mapping,
which renames the "age_key" output to "age.agekey" as it is written to the secret.
